<html>
<head><meta charset="utf-8"><title>ffi-unwind – meaning of C · project-ffi-unwind · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/index.html">project-ffi-unwind</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html">ffi-unwind – meaning of C</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="180220435"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180220435" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180220435">(Nov 08 2019 at 11:13)</a>:</h4>
<p><span class="user-mention" data-user-id="116009">@nikomatsakis</span> thanks for writing those thoughts</p>



<a name="180220540"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180220540" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180220540">(Nov 08 2019 at 11:15)</a>:</h4>
<p>I think there is also the issue of how "fine grained" we want to be with respect to the checks.</p>



<a name="180220713"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180220713" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180220713">(Nov 08 2019 at 11:18)</a>:</h4>
<p>About FFI with C ( but the same could apply to Rust), users want to FFI with C APIs that unwind and also that do not unwind, and for both cases, they sometimes want to "check" that they behave like they expected.</p>



<a name="180220738"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180220738" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180220738">(Nov 08 2019 at 11:19)</a>:</h4>
<p>That is, it is a reasonable use case to be able to interface with a C API that does not unwind, ever, without any checks.</p>



<a name="180220749"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180220749" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180220749">(Nov 08 2019 at 11:19)</a>:</h4>
<p>But it is also reasonable to want to maybe add checks in debug-builds, even for those, just in case, for example.</p>



<a name="180220823"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180220823" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180220823">(Nov 08 2019 at 11:20)</a>:</h4>
<p>And from there we go to interfacing with APIs that can unwind, where it might be reasonable to insert checks with <code>-C panic=abort</code> to make sure they don't unwind, but where it might also be reasonable to not insert those checks in that case, or to even produce a compiler error when a user tries to compile a crate that uses them with <code>-C panic=abort</code> (why wait till run-time here? well, for some APIs, it can be that they do not unwind under certain conditions, and the user upholds those).</p>



<a name="180220922"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180220922" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180220922">(Nov 08 2019 at 11:22)</a>:</h4>
<p>I think that all those use cases are valid, and that some of them can be kind of addressed with the <code>nounwind</code> keyword, or the <code>unwind(...)</code> attribute (e.g. <code>#[cfg_attr(test, unwinds(abort))]</code>).</p>



<a name="180221007"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180221007" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180221007">(Nov 08 2019 at 11:24)</a>:</h4>
<p>The problem of using attributes for customizing this behavior is that then the types of your API (e.g. <code>extern "C"</code> vs <code>extern "C unwind"</code>) might depend on whether you are doing a debug or release build.</p>



<a name="180221033"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180221033" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180221033">(Nov 08 2019 at 11:24)</a>:</h4>
<p>So maybe using a flag, e.g., like <code>-C debug-assertions</code> to control the behavior without changing types might be better, but then we add another "knob" to the compiler.</p>



<a name="180221077"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180221077" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180221077">(Nov 08 2019 at 11:25)</a>:</h4>
<p>Although a reasonable behavior might be to, for <code>extern "C unwind"</code> declarations in <code>-C panic=abort</code> crates to insert abort-on-unwind shims only if <code>-C debug-assertions</code> is enabled for the crate, reusing that knob for that.</p>



<a name="180235360"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180235360" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180235360">(Nov 08 2019 at 14:43)</a>:</h4>
<p><span class="user-mention" data-user-id="132920">@gnzlbg</span> -- I just amended the doc a lot, but I didn't have time to read these comments of yours yet -- also, I deleted your hackmd comments from the doc since I think they <em>might</em> be addressed, and I don't know another way to "resolve" comments in hackmd (it's comment system kinda' sucks)</p>



<a name="180235422"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180235422" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180235422">(Nov 08 2019 at 14:44)</a>:</h4>
<p>thanks, i'll take a look</p>



<a name="180235437"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180235437" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180235437">(Nov 08 2019 at 14:44)</a>:</h4>
<blockquote>
<p>But it is also reasonable to want to maybe add checks in debug-builds, even for those, just in case, for example.</p>
</blockquote>
<p>on this note, I totally agree, that is a worthwhile variation to consider, rather like how we handle overflow (except that we don't consider it UB in release builds)</p>



<a name="180235555"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180235555" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180235555">(Nov 08 2019 at 14:45)</a>:</h4>
<p>well, that said, I'm not sure if I like it. I think the key concern is that <code>-Cpanic=abort</code> is something imposed on a libary <strong>from the outside</strong> -- if the library is only compatible with one mode without UB (because it invokes foreign functions that unwind), we probably want to consider ways for it to declare that, versus just having it silently trigger UB. It feels.. different to me. Have to think about it.</p>



<a name="180236791"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180236791" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180236791">(Nov 08 2019 at 14:58)</a>:</h4>
<p>Yeah, me too.</p>



<a name="180236808"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180236808" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180236808">(Nov 08 2019 at 14:58)</a>:</h4>
<p>That's also why I'm not sure whether delaying an error in that case until run-time is the best solution either.</p>



<a name="180236864"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180236864" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180236864">(Nov 08 2019 at 14:59)</a>:</h4>
<p>If you compile a crate with <code>-C panic=abort</code> and then call a <code>extern "C unwind" { fn foo(); }</code> then, maybe you want a compilation error ?</p>



<a name="180237018"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237018" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237018">(Nov 08 2019 at 15:00)</a>:</h4>
<p>A compilation error wouldn't be great either, because people might end up having to work around that by doing:</p>
<div class="codehilite"><pre><span></span><span class="cp">#[cfg(panic = </span><span class="s">&quot;abort&quot;</span><span class="cp">)]</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">..</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="cp">#[cfg(panic = </span><span class="s">&quot;unwind&quot;</span><span class="cp">)]</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C unwind&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">..</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</pre></div>


<p>which seems unnecessary.</p>



<a name="180237102"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237102" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237102">(Nov 08 2019 at 15:01)</a>:</h4>
<p>Yet there are different pros/cons of the compilation-error, run-time error, or just UB cases, and for certain uses I imagine wanting some of them at one point or another, so I don't see a clear winner.</p>



<a name="180237236"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237236" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237236">(Nov 08 2019 at 15:03)</a>:</h4>
<blockquote>
<p>if the library is only compatible with one mode without UB (because it invokes foreign functions that unwind), we probably want to consider ways for it to declare that, versus just having it silently trigger UB. It feels.. different to me.</p>
</blockquote>
<p>I don't remember in which context this was discussed (maybe <span class="user-mention" data-user-id="120076">@Kyle Strand</span> does?), but I recall that it might be worth it to allow specifying that a crate only works with <code>-C panic=unwind</code>, for example, at the crate level.</p>



<a name="180237284"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237284" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237284">(Nov 08 2019 at 15:03)</a>:</h4>
<p>So that if you try to compile it with <code>-C panic=abort</code>, compilation fails.</p>



<a name="180237366"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237366" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237366">(Nov 08 2019 at 15:04)</a>:</h4>
<p>A different strategy might also be to solve this at the library level.</p>



<a name="180237394"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237394" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237394">(Nov 08 2019 at 15:04)</a>:</h4>
<p>We can say that unwinding from a <code>"C unwind"</code> function with <code>-C panic=abort</code> "unwinds"</p>



<a name="180237425"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237425" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237425">(Nov 08 2019 at 15:04)</a>:</h4>
<p>and that this unwinding is UB if it deallocates Rust types without calling their destructors</p>



<a name="180237461"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237461" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237461">(Nov 08 2019 at 15:05)</a>:</h4>
<p>(otherwise, there shouldn't really be an issue with it just unwinding - a <code>longjmp</code> with <code>-C panic=abort</code> does just that)</p>



<a name="180237587"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237587" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237587">(Nov 08 2019 at 15:06)</a>:</h4>
<p>We could then expose an <code>panic::abort_on_unwind&lt;F&gt;(F)</code> API  that can be used to call <code>F</code> and <code>abort</code> if it unwinds.</p>



<a name="180237630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237630">(Nov 08 2019 at 15:06)</a>:</h4>
<p>And that can be implemented in a library, without any language support, by just using <code>catch_unwind</code>.</p>



<a name="180237690"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237690" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237690">(Nov 08 2019 at 15:07)</a>:</h4>
<p>(or a similar API that allows catching foreign exceptions)</p>



<a name="180237790"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180237790" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180237790">(Nov 08 2019 at 15:08)</a>:</h4>
<p>People can then build their own "<code>abort_on_unwind&lt;F&gt;(F)</code>"-like helpers that do what they want (e.g. <code>abort</code> only in debug builds).</p>



<a name="180243753"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180243753" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180243753">(Nov 08 2019 at 16:06)</a>:</h4>
<blockquote>
<p>The problem of using attributes for customizing this behavior is that then the types of your API (e.g. <code>extern "C"</code> vs <code>extern "C unwind"</code>) might depend on whether you are doing a debug or release build.</p>
</blockquote>
<p>I think if we are going with attributes, that it will not be reflected in the ABI. One or the other.</p>



<a name="180243891"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180243891" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180243891">(Nov 08 2019 at 16:07)</a>:</h4>
<blockquote>
<p>That's also why I'm not sure whether delaying an error in that case until run-time is the best solution either.</p>
</blockquote>
<p>Yes, I agree, and this is an argument in favor of making people <em>opt-in</em> to unwinding</p>



<a name="180244050"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180244050" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180244050">(Nov 08 2019 at 16:08)</a>:</h4>
<p>but, as you say, the unwinding may be something that only occurs under certain runtime conditions --</p>



<a name="180244055"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180244055" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180244055">(Nov 08 2019 at 16:08)</a>:</h4>
<p>and moreover, aborting may be the right response!</p>



<a name="180244073"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180244073" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180244073">(Nov 08 2019 at 16:08)</a>:</h4>
<p>i.e., the whole point of <code>-Cpanic=abort</code> isn't that panics and fatal errors <em>never happen</em>, it's the we abort when they do</p>



<a name="180244095"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180244095" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180244095">(Nov 08 2019 at 16:09)</a>:</h4>
<p>I don't really see the advantage of "push this to the library level"</p>



<a name="180244112"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180244112" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180244112">(Nov 08 2019 at 16:09)</a>:</h4>
<p>That just seems like the existing "C" approach to me</p>



<a name="180244150"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180244150" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180244150">(Nov 08 2019 at 16:09)</a>:</h4>
<p>Or, put another way, that seems like it has precisely the problem that <code>-Cpanic=abort</code> kind of pushes UB onto libraries, and that people may fail to prepare properly for that.</p>



<a name="180244202"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180244202" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180244202">(Nov 08 2019 at 16:10)</a>:</h4>
<p>Thinking more about the "debugmode aborts", I think that would be a good thing to do for calls to functions where it is UB for them to unwind</p>



<a name="180244219"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180244219" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180244219">(Nov 08 2019 at 16:10)</a>:</h4>
<p>(but not in optimized builds)</p>



<a name="180244255"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180244255" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180244255">(Nov 08 2019 at 16:10)</a>:</h4>
<p>but I don't think it's answer to the question of <code>-Cpanic=abort</code> inducing UB "from the outside". I think an answer there has to be one where it is hard to do it wrong.</p>



<a name="180285149"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/210922-project-ffi-unwind/topic/ffi-unwind%20%E2%80%93%20meaning%20of%20C/near/180285149" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> BatmanAoD (Kyle Strand) <a href="https://rust-lang.github.io/zulip_archive/stream/210922-project-ffi-unwind/topic/ffi-unwind.20.E2.80.93.20meaning.20of.20C.html#180285149">(Nov 09 2019 at 00:02)</a>:</h4>
<blockquote>
<p>I don't remember in which context this was discussed (maybe <span class="user-mention silent" data-user-id="120076">Kyle Strand</span> does?), but I recall that it might be worth it to allow specifying that a crate only works with <code>-C panic=unwind</code>, for example, at the crate level.</p>
</blockquote>
<p>The only discussion I remember along these lines was in RFC <a href="https://github.com/rust-lang/rust/issues/2699" target="_blank" title="https://github.com/rust-lang/rust/issues/2699">#2699</a>.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>